Hardcoded crypto key or IV (ARCH311)

Key dotnet.security.hardcoded-crypto-key · Severity error · Category security · CWE CWE-321

A hardcoded key or IV lets anyone with source access decrypt protected data and cannot be rotated. Source keys from a secure store.

Incorrect

byte[] key = Encoding.UTF8.GetBytes("0123456789ABCDEF");
using var aes = Aes.Create();
aes.Key = key;

Correct

byte[] key = await keyVault.GetKeyAsync("data-key");
using var aes = Aes.Create();
aes.Key = key;

Fix

Remove key/IV literals; load keys from a secret manager or KMS and generate IVs randomly.